class OidcProviderNative (construct)
| Language | Type name |
|---|---|
 .NET | Amazon.CDK.AWS.Eks.V2.Alpha.OidcProviderNative |
 Go | github.com/aws/aws-cdk-go/awscdkeksv2alpha/v2#OidcProviderNative |
 Java | software.amazon.awscdk.services.eks.v2.alpha.OidcProviderNative |
 Python | aws_cdk.aws_eks_v2_alpha.OidcProviderNative |
 TypeScript (source) | @aws-cdk/aws-eks-v2-alpha » OidcProviderNative |
Implements
IConstruct, IDependable, IResource, IEnvironment, IOidc, IOIDCProvider
IAM OIDC identity providers are entities in IAM that describe an external identity provider (IdP) service that supports the OpenID Connect (OIDC) standard, such as Google or Salesforce.
You use an IAM OIDC identity provider when you want to establish trust between an OIDC-compatible IdP and your AWS account.
This implementation uses the native CloudFormation resource and has default values for thumbprints and clientIds props that will be compatible with the eks cluster.
See also: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html
Example
import * as s3 from 'aws-cdk-lib/aws-s3';
// you can import an existing provider
const provider = eks.OidcProviderNative.fromOidcProviderArn(this, 'Provider', 'arn:aws:iam::123456:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AB123456ABC');
// or create a new one using an existing issuer url
declare const issuerUrl: string;
const provider2 = new eks.OidcProviderNative(this, 'Provider', {
url: issuerUrl,
});
import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
const cluster = eks.Cluster.fromClusterAttributes(this, 'MyCluster', {
clusterName: 'Cluster',
openIdConnectProvider: provider,
kubectlProviderOptions: {
kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
}});
const serviceAccount = cluster.addServiceAccount('MyServiceAccount');
const bucket = new s3.Bucket(this, 'Bucket');
bucket.grantReadWrite(serviceAccount);
Initializer
new OidcProviderNative(scope: Construct, id: string, props: OidcProviderNativeProps)
Parameters
- scope
Construct— The definition scope. - id
string— Construct ID. - props
Oidc— Initialization properties.Provider Native Props
Defines a native OpenID Connect provider.
Construct Props
| Name | Type | Description |
|---|---|---|
| url | string | The URL of the identity provider. |
| removal | Removal | The removal policy to apply to the OpenID Connect Provider. |
url
Type:
string
The URL of the identity provider.
The URL must begin with https:// and should correspond to the iss claim in the provider's OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com.
You can find your OIDC Issuer URL by: aws eks describe-cluster --name %cluster_name% --query "cluster.identity.oidc.issuer" --output text
removalPolicy?
Type:
Removal
(optional, default: RemovalPolicy.DESTROY)
The removal policy to apply to the OpenID Connect Provider.
Properties
| Name | Type | Description |
|---|---|---|
| env | Resource | The environment this resource belongs to. |
| node | Node | The tree node. |
| oidc | string | The Amazon Resource Name (ARN) of the Native IAM OpenID Connect provider. |
| oidc | string | The issuer for the Native OIDC Provider. |
| oidc | OIDCProvider | A reference to a OIDCProvider resource. |
| oidc | string | The thumbprints configured for this provider. |
| open | string | The Amazon Resource Name (ARN) of the IAM OpenID Connect provider. |
| open | string | The issuer for OIDC Provider. |
| stack | Stack | The stack in which this resource is defined. |
| static PROPERTY_INJECTION_ID | string | Uniquely identifies this class. |
env
Type:
Resource
The environment this resource belongs to.
For resources that are created and managed in a Stack (those created by
creating new class instances like new Role(), new Bucket(), etc.), this
is always the same as the environment of the stack they belong to.
For referenced resources (those obtained from referencing methods like
Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be
different than the stack they were imported into.
node
Type:
Node
The tree node.
oidcProviderArn
Type:
string
The Amazon Resource Name (ARN) of the Native IAM OpenID Connect provider.
oidcProviderIssuer
Type:
string
The issuer for the Native OIDC Provider.
oidcProviderRef
Type:
OIDCProvider
A reference to a OIDCProvider resource.
oidcProviderThumbprints
Type:
string
The thumbprints configured for this provider.
openIdConnectProviderArn
⚠️ Deprecated: Use oidcProviderArn instead. This property exists for backward compatibility with existing constructs as migrating between the 2 constructs (OpenIdConnectProvider and OidcProviderNative) is not reasonably feasible as it requires a manual step (cdk import) since the resource type is changing between OpenIdConnectProvider and OidcProviderNative.
Type:
string
The Amazon Resource Name (ARN) of the IAM OpenID Connect provider.
openIdConnectProviderIssuer
⚠️ Deprecated: use oidcProviderIssuer instead. This property exists for backward compatibility with existing constructs as migrating between the 2 constructs (OpenIdConnectProvider and OidcProviderNative) is not reasonably feasible as it requires a manual step (cdk import) since the resource type is changing between OpenIdConnectProvider and OidcProviderNative.
Type:
string
The issuer for OIDC Provider.
stack
Type:
Stack
The stack in which this resource is defined.
static PROPERTY_INJECTION_ID
Type:
string
Uniquely identifies this class.
Methods
| Name | Description |
|---|---|
| apply | Apply the given removal policy to this resource. |
| to | Returns a string representation of this construct. |
applyRemovalPolicy(policy)
public applyRemovalPolicy(policy: RemovalPolicy): void
Parameters
- policy
RemovalPolicy
Apply the given removal policy to this resource.
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.
The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS
account for data recovery and cleanup later (RemovalPolicy.RETAIN).
toString()
public toString(): string
Returns
string
Returns a string representation of this construct.